Samba cannot be a Backup Domain Controller for an NT4 PDC because:

While NT4 PDCs have encryption limitations, Samba's inability to function as an NT4 BDC is primarily due to replication protocol issues, not solely encryption incompatibility, as Samba typically supports negotiation of encryption levels.

The fundamental technical barrier preventing Samba from acting as a Backup Domain Controller (BDC) for an NT4 PDC is the lack of a complete and stable implementation of the native Windows NT4 SAM (Security Account Manager) database replication protocols within Samba. This incomplete implementation means Samba cannot reliably synchronize its user and group database with an NT4 PDC.

Samba uses various database backends (e.g., TDB, LDAP), which differ from NT4's internal database, but this difference is handled by the replication protocol itself, meaning backend incompatibility is not the direct cause of the BDC limitation.

The Samba team's philosophy or preferences do not constitute a technical reason for the inability to implement BDC functionality; the limitation is purely technical regarding protocol support.